Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 1 of 51

Transcription

1 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 1 of 51 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK RICARDO VIGIL, ET AL., - against - Plaintiffs, 15-cv-8211 (JGK) OPINION AND ORDER TAKE-TWO INTERACTIVE SOFTWARE, INC., Defendant. JOHN G. KOELTL, District Judge: The advent of new technologies in the field of biometrics --- the field of science relating to the identification of humans based upon unique biological traits, such as fingerprints, DNA, and retinas --- has produced new ways of conducting commercial transactions. In 2008, to promote, regulate, and safeguard the use of biometrics in financial transactions, Illinois enacted the Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq. (the BIPA ), which sets forth disclosure, consent, and retention requirements for private entities that collect, store, and disseminate biometric data. The defendant, Take-Two Interactive Software, Inc. ( Take- Two ), is one such private entity that collects biometric data for use in its video games, NBA 2K15 and NBA 2K16. The plaintiffs, Vanessa Vigil and Ricardo Vigil, have brought this putative class action pursuant to the Class Action Fairness Act, 1

2 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 2 of U.S.C. 1332(d). More specifically, Ricardo Vigil bought and played NBA 2K15, and his sister Vanessa Vigil played his copy of that video game. The plaintiffs used a feature in the video game to scan their respective faces to create personalized virtual basketball players, exclusively for in-game play. Although the plaintiffs do not contend that their face scans have been disseminated, or used for any purpose, other than for playing the video game, for which they gave consent, the plaintiffs contend that Take-Two failed to comply with various provisions of the BIPA. On January 15, 2016, Take-Two moved pursuant to Rule 12(b)(1), and Rule 12(b)(6), of the Federal Rules of Civil Procedure to dismiss the plaintiffs claims. Subsequently, the Supreme Court issued Spokeo, Inc. v. Robin, 136 S. Ct (2016), which clarified that for an injury-in-fact to be concrete, it must be real, and not abstract, and that a bare procedural violation under a federal statute, divorced from any concrete harm, that may result in no harm, would not satisfy the injury-in-fact requirement. Id. at 1549 (internal quotation marks omitted). By Order dated July 1, 2016, this Court ruled that the plaintiffs should be allowed to replead in light of Spokeo, and denied without prejudice to renewal Take- Two s pending motion to dismiss. See Dkt. 42. The plaintiffs 2

3 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 3 of 51 filed their Second Amended Complaint, and Take-Two renewed its motion. The parties subsequently submitted supplemental letters concerning the impact of Strubel v. Comenity Bank, No CV, 2016 WL (2d Cir. Nov. 23, 2016), which interpreted Spokeo. For the following reasons, Take-Two s motion to dismiss the Second Amended Complaint is granted. 1 I. When presented with a motion to dismiss under Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction, and a motion to dismiss on other grounds, the first issue is whether the Court has the subject matter jurisdiction necessary to consider the merits of the action. See Rhulen Agency, Inc. v. Alabama Ins. Guar. Ass n, 896 F.2d 674, 678 (2d Cir. 1990). In defending against a motion to dismiss for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure, the plaintiff bears the burden of proving the Court s jurisdiction by a preponderance of the 1 Take-Two has moved in the alternative to strike the Second Amended Complaint s class allegations. Because the Second Amended Complaint is dismissed for want of standing, and for failure to establish a cause of action under the BIPA, it is unnecessary to reach the alternative basis for relief. Take- Two s motion to strike the Second Amended Complaint s class allegations is therefore denied as moot. 3

4 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 4 of 51 evidence. Makarova v. United States, 201 F.3d 110, 113 (2d Cir. 2000). In considering such a motion, the Court generally must accept the material factual allegations in the complaint as true. See J.S. ex rel. N.S. v. Attica Cent. Schs., 386 F.3d 107, 110 (2d Cir. 2004). The Court does not, however, draw all reasonable inferences in the plaintiff s favor. Id.; see also Graubart v. Jazz Images-, Inc., No. 02-CV-4645 (KMK), 2006 WL , at *2 (S.D.N.Y. Apr. 27, 2006). Indeed, where jurisdictional facts are disputed, the Court has the power and the obligation to consider matters outside the pleadings, such as affidavits, documents, and testimony, to determine whether jurisdiction exists. See Anglo Iberia Underwriting Mgmt. Co. v. P.T. Jamsostek, 600 F.3d 171, 175 (2d Cir. 2010); APWU v. Potter, 343 F.3d 619, 627 (2d Cir. 2003); Kamen v. Am. Tel. & Tel. Co., 791 F.2d 1006, 1011 (2d Cir. 1986). In so doing, the Court is guided by the body of decisional law that has developed under Rule 56 of the Federal Rules of Civil Procedure. Kamen, 791 F.2d at 1011; see also Aguilar v. Immigration & Customs Enf t Div. of the U.S. Dep t of Homeland Sec., 811 F. Supp. 2d 803, (S.D.N.Y. 2011). In deciding a motion to dismiss pursuant to Rule 12(b)(6), the allegations in the complaint are accepted as true, and all reasonable inferences must be drawn in the plaintiff s favor. McCarthy v. Dun & Bradstreet Corp., 482 F.3d 184, 191 (2d Cir. 4

5 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 5 of ). The Court s function on a motion to dismiss is not to weigh the evidence that might be presented at a trial but merely to determine whether the complaint itself is legally sufficient. Goldman v. Belden, 754 F.2d 1059, 1067 (2d Cir. 1985). The Court should not dismiss the complaint if the plaintiff has stated enough facts to state a claim to relief that is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While the Court should construe the factual allegations in the light most favorable to the plaintiff, the tenet that a court must accept as true all of the allegations contained in the complaint is inapplicable to legal conclusions. Id. When presented with a motion to dismiss pursuant to Rule 12(b)(6), the Court may consider documents that are referenced in the complaint, documents that the plaintiff relied on in bringing suit and that are either in the plaintiff s possession or that the plaintiff knew of when bringing suit, or matters of which judicial notice may be taken. See Chambers v. Time Warner, Inc., 282 F.3d 147, 153 (2d Cir. 2002). 5

6 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 6 of 51 II. Illinois enacted the BIPA in The legislative findings accompanying the BIPA explain that the BIPA was passed, in part, because the Illinois legislature anticipated that commercial businesses would increasingly use biometric data, such as fingerprints, to facilitate financial transactions. 740 Ill. Comp. Stat. 14/5(a-b). As the Illinois legislature observed, biometric data are by definition unique, and thus --- unlike a credit card number --- cannot realistically be changed if they are subject to identity theft. See 740 Ill. Comp. Stat. 14/5(c). The Illinois legislature was concerned that the failure of businesses to implement reasonable safeguards for such data would deter Illinois citizens from partaking in biometric identifier-facilitated transactions in the first place, and would thus discourage the proliferation of such transactions as a form of engaging in commerce. 740 Ill. Comp. Stat. 14/5(e). The BIPA represents the Illinois legislature s judgment that the collection and storage of biometrics to facilitate financial transactions is not in-of-itself undesirable or impermissible; instead, the purpose of the BIPA is to ensure that, when an individual engages in a biometric-facilitated transaction, the private entity protects the individual s biometric data, and does not use that data for an improper purpose, especially a 6

7 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 7 of 51 purpose not contemplated by the underlying transaction. See 740 Ill. Comp. Stat. 14/5(a-g). Under the BIPA, a biometric identifier is a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, while biometric information is information based on biometric identifiers. 740 Ill. Comp. Stat. 14/10. Among other things, the BIPA includes a number of provisions to regulate the collection, dissemination, and storage of biometric identifiers and biometric information. First, Section 15(a) provides that: A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual s last interaction with the private entity, whichever occurs first. See 740 Ill. Comp. Stat. 14/15(a). Second, the BIPA requires private entities to store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity s industry, and to treat such identifiers and information as sensitive and confidential. 740 Ill. Comp. Stat. 14/15(e). Third, Section 15(b) provides that a private entity that collects biometric identifiers or biometric information must (1) 7

8 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 8 of 51 inform the subject in writing that a biometric identifier, or biometric information, is being collected; (2) inform the subject in writing of the purpose and length of the collection and storage; and (3) receive a written release from the subject. 740 Ill. Comp. Stat. 14/15(b). Fourth, Section 15(c) prohibits private entities from selling biometric identifiers and biometric information to third-parties. 740 Ill. Comp. Stat. 14/15(c). Finally, and relatedly, Section 15(d) prohibits private entities from disseminating biometric identifiers and biometric information without prior written consent, or unless such dissemination is necessary to complete a financial transaction authorized by the subject. 740 Ill. Comp. Stat. 14/15(d). The BIPA provides that any person aggrieved by a violation of the BIPA may pursue money damages and injunctive relief against the offending party. 2 See 740 Ill. Comp. Stat. 14/20. The BIPA also provides for attorney s fees to be awarded to the prevailing party. See id. 2 Specifically, the BIPA provides that the prevailing party may recover the greater of $1,000 in liquidated damages, or actual damages, for each negligent violation of the BIPA, and the greater of $5,000 in liquidated damages, or actual damages, for each reckless or intentional violation of the BIPA. See 740 Ill. Comp. Stat. 14/20. 8

9 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 9 of 51 III. A. Take-Two is a Delaware corporation, with its headquarters and principal place of business located in New York, New York, that publishes, develops, and distributes video games. SAC 1, 9. Among numerous other video games, Take-Two publishes, develops, and distributes the popular video games NBA 2K15 and NBA 2K16 (collectively, the NBA 2K Games ) that are playable on personal computers and other gaming platforms. SAC 1. The NBA 2K Games are basketball simulation video games that allow a gamer to play as, and against, virtual basketball players, many of whom are designed based upon real professional players from the National Basketball Association. SAC 27. A gamer can play the NBA 2K Games in multiplayer mode with other gamers over the Internet. See, e.g., SAC 36. The NBA 2K Games include the MyPlayer feature, which allows a gamer to create a personalized basketball avatar based upon a three-dimensional rendition of the gamer s face. SAC 27, 29. To create the avatar, the NBA 2K Games use cameras connected to the gaming platform to scan the gamer s face and head. SAC 29. The scanning is a lengthy and involved process that takes about 15 minutes, during which time the gamer must stare up-close at the camera while also turning his or her head from side-to-side at regular intervals. SAC 29. 9

10 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 10 of 51 The plaintiffs allege that Take-Two s proprietary technology extracts geometric data from the scan related to the unique points and contours of the gamer s face, and converts that data into a personally identifying animated rendition of the gamer s face. SAC The rendition then becomes the face of the gamer s personalized basketball avatar for in-game play. SAC 29. The MyPlayer feature s only alleged purpose is to create personalized basketball avatars. See SAC 27. If a gamer wishes to use the MyPlayer feature, the gamer must first agree to the following terms and conditions: Your face scan will be visible to you and others you play with and may be recorded or screen captured during gameplay. By proceeding you agree and consent to such uses and other uses pursuant to the End User License Agreement. See SAC Third-party gamers can view the rendition if the gamer choses to play with the personalized basketball avatar in multiplayer mode. See SAC 35. There is no requirement that a gamer who uses the MyPlayer feature be an actual purchaser or owner of an NBA 2K Game. See SAC 40. The plaintiffs allege that Take-Two indefinitely stores the biometric information it collects through the face scans on its servers. SAC 28. They also allege that Take-Two transmits unencrypted biometric information through the open commercial 3 The hyperlink in the terms and conditions links to Take-Two s Limited Software Warranty and License Agreement. 10

11 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 11 of 51 Internet. SAC 35. The plaintiffs further allege that Take-Two markets and advertises the MyPlayer feature. SAC 36. B. The plaintiffs, Ricardo Vigil and Vanessa Vigil, are siblings, and are alleged to be residents and citizens of Illinois. SAC 7-8, The Second Amended Complaint alleges that Ricardo Vigil is the purchaser and owner of a copy of NBA 2K15, and that Vanessa Vigil played her brother s copy of the game. SAC The plaintiffs allege that they each used the MyPlayer feature to scan their faces to create their own personalized basketball avatars. SAC 41. Prior to the scanning, the plaintiffs allege that they each agreed to the MyPlayer terms and conditions described above. SAC 41. The plaintiffs allege that they subsequently chose to enter a multiplayer game with their personalized basketball avatars, meaning that the digital renditions of their faces, which the plaintiffs claim constitute biometric information under the BIPA, were visible to thirdparties also playing NBA 2K15. SAC 45. The Second Amended Complaint contains no allegations regarding the quality of the plaintiffs personalized basketball avatars, such as the degree to which the digitized faces of the plaintiffs avatars resembled the plaintiffs. 11

12 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 12 of 51 Even though the plaintiffs agreed to the MyPlayer terms and conditions, the plaintiffs allege that they failed to appreciate the gravity associated with using MyPlayer --- especially that renditions of their face scans would be allegedly indefinitely stored on Take-Two s servers, transmitted over the commercial Internet, and subject to allegedly inadequate protections --- because they did not receive adequate written disclosures from Take-Two. See SAC The plaintiffs allege that they have both become weary of participating in biometric-facilitated transactions, and have since refrained from participating in such transactions due to their experience with NBA 2K15. SAC 61. The Second Amended Complaint alleges that Ricardo Vigil s purchase of NBA 2K15 was motivated in material part by his desire to use the MyPlayer feature, but that he did not at the time of the purchase understand Take-Two s alleged practices with respect to biometric information. SAC The Second Amended Complaint alleges that, After purchasing and opening the packaging on the NBA 2K15 video game, Plaintiff Ricardo Vigil had no option to return the video game for a monetary refund, and that he has therefore suffered tangible, monetary harm. SAC 55. There is no allegation that the plaintiffs did not realize that their own faces were unique identifiers prior to using the 12

13 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 13 of 51 MyPlayer feature. There is no allegation that the plaintiffs did not understand that the only purpose of the MyPlayer feature was to create a personalized basketball avatar for in-game play, including in multiplayer mode. And there is no allegation that the plaintiffs face scans have been disseminated in any form other than to the gamers who played in multiplayer games with the plaintiffs. 4 The plaintiffs claim that Take-Two has violated the BIPA in almost every respect. First, the plaintiffs claim that Take-Two did not publicly provide a retention schedule or guidelines for permanently destroying biometric identifiers in violation of Section 15(a). SAC 38, 75. Second, they claim that Take-Two failed to inform the plaintiffs properly in writing that their biometric identifiers would be collected, and failed to explain the purpose and length of that collection, in violation of Section 15(b). SAC 32-33, 73. Third, the plaintiffs claim that Take-Two collected biometric information without first obtaining a written release from the plaintiffs, also in violation of Section 15(b). SAC 34, 74. Fourth, the plaintiffs claim that Take-Two disclosed and disseminated their biometric identifiers without obtaining adequate consent in 4 Counsel for the plaintiffs made clear at oral argument that the plaintiffs are not seeking to base their claims on their volitional entrance into multiplayer games, where the digital renditions of their faces on the personalized basketball avatars could be viewed by third-parties. 13

14 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 14 of 51 violation of Section 15(d). SAC 35, 76. Fifth, the plaintiffs claim that Take-Two failed to transmit their biometric identifiers with industry-standard reasonable care in violation of Section 15(e). SAC 35, 37, 77. Finally, the plaintiffs claim that Take-Two has profited from the plaintiffs biometric identifiers in violation of Section 15(c). SAC 36, 57, 78. The plaintiffs seek money damages, injunctive relief, and reasonable attorney s fees. SAC IV. The plaintiffs have compiled a long list of purported technical violations of the BIPA. In an effort to create standing to pursue their claims for these technical violations, the plaintiffs try several different alleged theories of harm, variously arguing that they have suffered from the procedural violations themselves (including from informational injuries and the enhanced risk of harm that their face scans will be subject to a data breach); apprehension about engaging in future biometric-facilitated transactions; misappropriation; intrusion on seclusion; and a diminished benefit-of-the-bargain associated with purchasing NBA 2K15. Take-Two has moved to dismiss the Second Amended Complaint for two reasons. First, pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure, Take-Two argues that the plaintiffs do not have Article III standing to pursue their claims under the 14

15 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 15 of 51 Constitution. Second, pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure, Take-Two argues that the plaintiffs do not have a cause of action under the BIPA. 5 A. Article III of the United States Constitution limits the jurisdiction of federal courts to Cases and Controversies. Lujan v. Defenders of Wildlife, 504 U.S. 555, 559 (1992). To satisfy the requirements of Article III standing, a plaintiff must show that (1) the plaintiff has suffered an actual or imminent injury in fact, which is concrete and particularized; (2) there is a causal connection between the injury and defendant s actions; and (3) it is likely that a favorable decision in the case will redress the injury. Id. at The party invoking federal jurisdiction bears the burden of establishing these elements. Id. at 561; see also Springer v. 5 Take-Two semantically framed its second argument for dismissal as being based on statutory standing grounds, but the Supreme Court has recently clarified... that what has been called statutory standing in fact is not a standing issue, but simply a question of whether the particular plaintiff has a cause of action under the statute. Am. Psychiatric Ass n v. Anthem Health Plans, Inc., 821 F.3d 352, 359 (2d Cir. 2016) (quoting Lexmark Int l, Inc. v. Static Control Components, Inc., 134 S. Ct. 1377, 1387 (2014)). The Court of Appeals has advised that courts should avoid [the statutory standing] appellation going forward. Id.; see also Leyse v. Bank of Am. Nat. Ass n, 804 F.3d 316, 320 (3d Cir. 2015) ( A dismissal for lack of statutory standing is effectively the same as a dismissal for failure to state a claim, and a motion to dismiss on this ground is brought pursuant to Rule 12(b)(6), rather than Rule 12(b)(1). (citation and internal quotation marks omitted)). 15

16 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 16 of 51 U.S. Bank Nat l Ass n, No. 15-CV-1107(JGK), 2015 WL , at *3 (S.D.N.Y. Dec. 23, 2015). In a class action, a court must analyze the injuries allegedly suffered by the named plaintiffs, not unnamed members of the potential class, to determine whether the plaintiffs have Article III standing. Warth v. Seldin, 422 U.S. 490, 502 (1975). A legally protected interest may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing. Id. at 500. However, the injury-in-fact requirement is a hard floor of Article III jurisdiction that cannot be removed by statute. Summers v. Earth Island Inst., 555 U.S. 488, 497 (2009). An allegation of future injury may suffice if the threatened injury is certainly impending, or there is a substantial risk that the harm will occur. Susan B. Anthony List v. Driehaus, 134 S. Ct. 2334, 2341 (2014) (quoting Clapper v. Amnesty Int l USA, 133 S. Ct. 1138, 1150 n.5 (2013)). The Supreme Court in Spokeo, Inc. v. Robin, 136 S. Ct (2016), recently clarified that [f]or an injury to be particularized, it must affect the plaintiff in a personal and individual way, id. at 1548 (quoting Lujan, 504 U.S. at 560 n.l), while for an injury to be concrete, it must be real, and not abstract, id. at 1548 (internal quotation marks omitted). The Court instructed that the determination of whether a violation 16

17 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 17 of 51 of a statute constitutes a concrete injury-in-fact is aided by reference to congressional intent and the common law. Id. However, Spokeo held that although Congress may elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law, id. at 1549 (quoting Lujan, 504 U.S. at 578), a bare procedural violation under a federal statute, divorced from any concrete harm, that may result in no harm, would not satisfy the injury-in-fact requirement. Id. In the context of the Fair Credit Reporting Act (the FCRA ) --- which requires consumer reporting agencies to follow reasonable procedures to assure maximum possible accuracy of consumer reports, and to notify providers and users of consumer information of their responsibilities under the [FCRA], and gives an injured individual a private right of action for an agency s willful failure to comply with the FCRA, see id. at 1545 (citations omitted) --- the Supreme Court in Spokeo observed that an agency that merely disseminated a deficient statutory notice, or inaccurate information that was not materially inaccurate, absent more, would have only 17

18 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 18 of 51 committed bare procedural violations of the FCRA that would not give rise to a concrete injury, see id. at The Court of Appeals for the Second Circuit in Strubel v. Comenity Bank, No CV, 2016 WL (2d Cir. Nov. 23, 2016), interpreted Spokeo, and the cases cited therein, to instruct that an alleged procedural violation can by itself manifest concrete injury where Congress conferred the procedural right to protect a plaintiff s concrete interests and where the procedural violation presents a risk of real harm to that concrete interest. But even where Congress has accorded procedural rights to protect a concrete interest, a plaintiff may fail to demonstrate concrete injury where violation of the procedure at issue presents no material risk of harm to that underlying interest. Id. at *5 (citation omitted). In Strubel, a consumer claimed that a bank s allegedly deficient disclosures violated the Truth in Lending Act (the TILA ), and entitled the consumer to seek statutory damages under the TILA. See id. at *1-2. The Court of Appeals began its assessment of the consumer s standing by analyzing the concrete interests protected by the TILA. See id. at *4 ( [T]o determine whether a procedural violation manifests injury in fact, a court properly considers whether Congress conferred the procedural right in 6 The Article III principles articulated in Spokeo also apply to laws enacted by the States. See Hecht v. Hertz Corp., No. 2:16- CV (WJM), 2016 WL , at *3 (D.N.J. Oct. 20, 2016). 18

19 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 19 of 51 order to protect an individual s concrete interests. ). The court observed that the goals of the TILA s disclosure requirements are to protect consumers against inaccurate and unfair credit billing and credit card practices and promote the informed use of credit by assuring a meaningful disclosure of credit terms. Id. at *2 (citation and internal quotation marks omitted). In other words, these were the concrete interests that the TILA s mandatory disclosure requirements were designed to protect. See id. The Court of Appeals concluded that the consumer had standing to pursue only some of her claims of TILA violations. The court found that the consumer had standing to pursue claims related to notice violations that could actually hinder the exercise of her prospective rights as a consumer, without any allegations of additional harm, because those violations could frustrate a core object of the TILA of avoiding the uninformed use of credit. Id. at *5 (citation and internal quotation marks omitted). As the court observed, A consumer who is not given notice of his obligations is likely not to satisfy them and, thereby, unwittingly to lose the very credit rights that the law affords him. Id. By contrast, the Court of Appeals found that a claim based upon the failure to present clearly certain information in the notice about the bank s prospective obligations to the consumer 19

20 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 20 of but that could not plausibly obscure prospective rights that the consumer could exercise --- would be too abstract to support standing because no actual harm resulted, and, even if a risk of harm had materialized, the bank could have still complied with its obligations under the TILA despite the deficient notice about its obligations. See id. at *8 ( It would be more than curious to conclude that a consumer sustains real injury to concrete TILA interests simply from a creditor s failure to advise of a reporting obligation that, in the end, the creditor honors. ). There was no real material risk that the goals of the TILA would be frustrated by these statutory violations. See id. at *7-8. While not dispositive, the Court of Appeals also noted that the consumer had not alleged that she (or, more generally, any consumer) would have changed her behavior to avoid any adverse consequences from the deficient notice, which further weighed against a finding of standing. Id. at *7. In addition, the Court of Appeals found that the bank s failure to notify the consumer about a credit product that the bank did not offer could not support standing. Id. at *6. Also instructive is a recent decision of the United States District Court for the Northern District of Illinois in McCollough v. Smarte Carte, Inc., No. 16 CV 03777, 2016 WL (N.D. Ill. Aug. 1, 2016), which denied standing to a plaintiff for alleged violations of the BIPA. In that case, the 20

21 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 21 of 51 defendant provided for rent a fingerprint-coded locker that used the plaintiff s fingerprint as the key to lock and unlock the locker. See id. at *1. The plaintiff claimed that the defendant had violated multiple provisions of the BIPA. See id. Specifically, the plaintiff alleged that the defendant collected and indefinitely retained fingerprint data without publishing any destruction guidelines. See id. at *1-2. The plaintiff also alleged that the defendant failed to give any notice, or receive any written consent acknowledging, that the defendant was collecting or using biometric identifiers. Id. at *1. The court dismissed the plaintiff s claims of bare procedural and technical violations of the BIPA for want of Article III standing, reasoning that the plaintiff undoubtedly understood when she first used the system that her fingerprint data would have to be retained until she retrieved her belongings from the locker. Id. at *3. As the court held, Even without prior written consent to retain, if [the defendant] did indeed retain the fingerprint data beyond the rental period, this Court finds it difficult to imagine, without more, how this retention could work a concrete harm. Id. at *4 (citing Gubala v. Time Warner Cable, Inc., No. 15-CV-1078-PP, 2016 WL , at *4 (E.D. Wis. June 17, 2016), aff d, No , 2017 WL (7th Cir. Jan. 20, 2017)); see also Gubala v. Time Warner Cable, Inc., No , 2017 WL , at *1-4 (7th Cir. Jan. 20, 21

22 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 22 of ) (dismissing for lack of Article III standing claims for alleged violations of the Cable Communications Policy Act (the CCPA ), a data protection statute analogous to the BIPA); Braitberg v. Charter Commc ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016). 7 (i) The plaintiffs argue that the purported procedural violations of the BIPA, without any allegations of additional harm, are sufficient to confer standing. The plaintiffs allegations of procedural violations fall into two interconnected categories: violation of the provisions regulating the storage and dissemination of biometric information, see 740 Ill. Comp. Stat. 14/15(a), (b), (c), (e), and violation of the provisions governing notice and consent, see 740 Ill. Comp. Stat. 14/15(a), (b), (d). Under Strubel, to assess the plaintiffs standing to pursue their claims, the first task is to identify any concrete interests protected by the BIPA. The plaintiffs contend that an individual s right to privacy in the individual s biometrics is 7 As explained below, the court in McCollough, 2016 WL , at *4, also held that the plaintiff did not have a cause of action under the BIPA because the plaintiff was a not a person aggrieved by a violation of the statute within the meaning of the BIPA. The conclusion that the alleged procedural violations here cannot support Article III standing is bolstered by the conclusion that the plaintiffs do not have a cause of action under the BIPA. 22

23 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 23 of 51 the concrete interest protected by the BIPA. Cf. In re Facebook Biometric Info. Privacy Litig., No. 15-CV JD, 2016 WL , at *10 (N.D. Cal. May 5, 2016) (reasoning that, for conflict of laws purposes, the BIPA manifests Illinois substantial policy of protecting its citizens right to privacy in their personal biometric data ). 8 Put more finely, [t]he core object, Strubel, 2016 WL , at *5, of the BIPA is data protection to curb potential misuse of biometric information collected by private entities. The provisions of the BIPA plainly seek to ensure that, when an individual engages in a biometric-facilitated transaction, the private entity protects the individual s biometric data, and does not use that data in a way not contemplated by the underlying transaction. The BIPA expressly contemplates the use of biometric information for the transactions contemplated by the parties. See also 740 Ill. Comp. Stat. 14/10(d)(2) (permitting disclosure or redisclosure of biometrics that completes the financial transaction ). None of the plaintiffs allegations of procedural violations, on their own, demonstrate a material risk of harm to the BIPA s concrete data protection interest because there is no plausible allegation that there is a material risk that the plaintiffs biometrics may be used in a way not contemplated by 8 In re Facebook, 2016 WL , at *11, did not consider any standing issues, and thus is of limited relevance to the standing question here. 23

24 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 24 of 51 the underlying use of the MyPlayer feature. The plaintiffs allege that they agreed to the MyPlayer terms and conditions, that NBA 2K15 scanned their faces to create personalized basketball avatars, and that the plaintiffs used their personalized basketball avatars for in-game play. The plaintiffs thus allege that the MyPlayer feature functioned exactly as anticipated. There is no allegation that Take-Two has disseminated or sold the plaintiffs biometric data to thirdparties, or that Take-Two has used the plaintiffs biometric information in any way not contemplated by the only possible use of the MyPlayer feature: the creation of personalized basketball avatars for in-game play. See Boelter v. Hearst Commc ns, Inc., No. 15-cv-3934, 2016 WL , at *3 (S.D.N.Y. June 17, 2016) (holding that the plaintiffs had standing to pursue claims for alleged violations of the Michigan Video Rental Privacy Act where the defendant-company, without permission, sold personal data to third-parties, including data mining companies). The purported violations of the BIPA are, at best, marginal, and the plaintiffs lack standing to pursue their claims for the alleged bare procedural violations of the BIPA. (a) With respect to the purported violations of the BIPA s storage and dissemination provisions, the plaintiffs fail to establish that there is an imminent risk of harm that Take-Two s 24

25 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 25 of 51 storage and dissemination of their facial scans could compromise the data protection interest of the BIPA. The plaintiffs primarily predicate their standing argument on Take-Two s alleged failure to store and transmit their facial scans with a reasonable degree of industry-standard care, and in a manner used for other types of confidential and sensitive information, in violation of Section 15(e) of the BIPA. In Strubel, the Court of Appeals cited the decision of the Court of Appeals for the Eighth Circuit in Braitberg, 836 F.3d at , which held that [the] unlawful retention of personal information did not manifest concrete injury absent alleged disclosure or misuse, Strubel, 2016 WL , at *8 n.15, and the decision of the Court of Appeals for the Sixth Circuit in Galaria v. Nationwide Mut. Ins. Co., 2016 WL , at *3 (6th Cir. Sept. 12, 2016) (summary order), which held that the failure to adopt statutorily mandated procedures to protect against wrongful dissemination of data manifested concrete injury where plaintiffs alleged data was stolen. Strubel, 2016 WL , at *8 n.15. This case is plainly more analogous to Braitberg than Galaria. The plaintiffs allegations do not establish an imminent risk that their biometrics could actually be misused, and there has been no event, such as the data theft in Galaria, that could make any such risk rise above the abstract level. See also Gubala, 2017 WL , at *1 ( [The 25

26 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 26 of 51 plaintiff] has presented neither allegation nor evidence of having been aggrieved by [the defendant s] violation of [the CCPA] no allegation or evidence that in the decade since he subscribed to [the defendant s] residential services any of the personal information that he supplied to the company when he subscribed had leaked and caused financial or other injury to him or had even been at risk of being leaked. ). At best, the plaintiffs allegations are that Take-Two s storage and dissemination practices have subjected their facial scans to an enhanced risk of harm of somehow falling into the wrong hands, which is too abstract and speculative to support standing. See McCollough, 2016 WL , at *4; see also, e.g., Nat l Council of La Raza v. Gonzales, 468 F. Supp. 2d 429, 444 (E.D.N.Y. 2007) ( [S]peculation that... some unauthorized party may access plaintiffs [information stored in a database] in violation of a plaintiff members privacy right does not satisfy the requirement that plaintiffs identify an actual or imminent, concrete and particularized injury. ); Gubala, 2017 WL , at *1-2, *4; Braitberg, 836 F.3d at 930; Chambliss v. Carefirst, Inc, No. CV RDB , 2016 WL , at *2 (D. Md. May 27, 2016) (dismissing claims for failure to protect personal data in compliance with the Maryland Personal Information Protection Act for want of standing); see also Clapper, 133 S. Ct. at 1150 (expressing our usual reluctance to 26

27 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 27 of 51 endorse standing theories that rest on speculation about the decisions of independent actors ). Indeed, the plaintiffs do not allege that their face scans have been obtained by a thirdparty, subjected to identity theft, or misused in any way. The plaintiffs attempt to circumvent the speculative and abstract nature of their claims by arguing that the potential risk of harm associated with the face scans could be potentially great because faces are relatively immutable, and, unlike (for example) passwords, cannot be changed. But the hypothetical magnitude of a highly speculative and abstract injury that is not certainly impending does not make the injury any less speculative and abstract. See Clapper, 133 S. Ct. at ; Summers, 555 U.S. at 497 ( [T]he injury-in-fact requirement is a hard floor of Article III jurisdiction that cannot be removed by statute. ). The plaintiffs also argue that Take-Two violated Section 15(c) of the BIPA by somehow profiting from the plaintiffs facial scans when the plaintiffs played NBA 2K15 with their personalized basketball avatars in multiplayer mode. The plaintiffs theory appears to be that Take-Two advertises the MyPlayer feature, which encourages individuals to purchase NBA 2K15 games. 9 The allegations are insufficient for standing 9 The plaintiffs claim here appears to be based on a misreading of the BIPA. Section 15(c) of the BIPA provides that, No 27

28 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 28 of 51 because they do not establish that the plaintiffs suffered any actual or imminent harm as a result of Take-Two s advertising practices. The plaintiffs allege that Take-Two has advertised the MyPlayer feature; they do not allege that Take-Two has used their facial scans to promote or advertise NBA 2K15, or that Take-Two has otherwise profited from their facial scans by, for example, selling the scans to third-parties. (b) With respect to the purported violations of the notice and consent provisions, the plaintiffs claim that the notice and consent that they received was insufficient because the MyPlayer feature terms and conditions did not specifically disclose that private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person s or a customer s biometric identifier or biometric information. 740 Ill. Comp. Stat. 14/15(c) (emphasis added). The plaintiffs appear to interpret profiting to mean that a private entity violates the BIPA by selling a game that includes a biometric-related feature. That interpretation is plainly at odds with the BIPA, which is designed to regulate and promote, but not inhibit, biometric-facilitated transactions. Instead, Section 15(c) is clearly geared toward prohibiting the unauthorized dissemination of biometric information that a private entity is already in possession of due to an underlying biometric-facilitated transaction, but where the dissemination is not otherwise contemplated by the underlying biometric-facilitated transaction. In relation to the other terms in Section 15(c) --- selling, leasing, and trading --- otherwise profiting is a catchall for prohibiting commercially transferring biometric information and biometric identifiers in a manner not contemplated by the original biometric-facilitated transaction, without consent from the individual pursuant to Section 15(d). Promoting a transaction --- here, the sale of a video game --- by advertising a biometric-related feature does not contravene the statute. 28

29 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 29 of 51 their faces constituted biometrics, the purpose of the scanning, or the length of the face scan retention period; because the plaintiffs consent to use the MyPlayer feature was not embodied in a writing; and because Take-Two did not publish a biometric retention schedule. These violations can only support standing if they pose a material risk of harm to the data protection goal of the BIPA. At best, more extensive notice and consent could have dissuaded the plaintiffs from using the MyPlayer feature, meaning that Take-Two would have never collected the plaintiffs biometrics. But the plaintiffs have failed to establish that their use of the MyPlayer feature resulted in any imminent risk that the data protection goal of the BIPA would be frustrated. Consequently, more extensive notice and consent could not have altered the standing equation because there has been no material risk of harm to a concrete BIPA interest that more extensive notice and consent would have avoided. The plaintiffs argue that the alleged notice and consent violations harmed their right-to-information about the underlying biometric transaction, which the plaintiffs contend should be sufficient in-of-itself to confer standing without any allegations of additional harm. The purported right-toinformation about a biometric-facilitated transaction is not a concrete interest separate from the core object of the BIPA to prevent biometric data misuse. The alleged failure to give the 29

30 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 30 of 51 plaintiffs more extensive notice and consent is not a material risk to a concrete BIPA interest where no material risk of biometric data misuse ever materialized. See Spokeo, 136 S. Ct. at 1549; McCollough, 2016 WL , at *3-4. Contrary to the plaintiffs arguments, the BIPA is not akin to a statute where the right-to-information is a concrete interest in-of-itself, such as a statute designed to give a consumer information about prospective statutory rights that the consumer could exercise, but that might otherwise be lost, see Strubel, 2016 WL , at *5-6 (discussing the TILA); a statute designed to provide information about government activities, see FEC v. Akins, 524 U.S. 11, 21 (1998) (the Federal Election Campaign Act); Pub. Citizen v. Dep t of Justice, 491 U.S. 440, (1989) (the Federal Advisory Committee Act); or a statute designed to remedy housing discrimination by ensuring that all individuals, including protected classes, receive truthful information about housing availabilities, see Havens Realty Corp. v. Coleman, 455 U.S. 363, 374 (1982) (the Fair Housing Act). Unlike statutes where the provision of information about statutory rights, or matters of public concern, is an end itself, the BIPA s notice and consent provisions do not create a separate interest in the right-to-information, but instead operate in support of the data protection goal of the statute. 30

31 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 31 of 51 Section 15(a) requires that private entities publish retention and destruction schedules for biometric data. However, a private entity may destroy biometrics pursuant to the requirements set forth in Section 15(a), and thus effectively comply with the core data protection goal of the BIPA while also technically violating the BIPA by failing to publish a retention schedule. See Strubel, 2016 WL , at *8 ( It would be more than curious to conclude that a consumer sustains real injury to concrete TILA interests simply from a creditor s failure to advise of a reporting obligation that, in the end, the creditor honors. ). The BIPA s mandated disclosures are minimal. Section 15(b) of the BIPA simply provides that a notice must inform[] the subject... in writing that a biometric identifier or biometric information is being collected or stored, that the notice must include the length and purpose of that collection, and that consent must be in writing. The BIPA s disclosure and consent requirements are plainly designed to allow parties to set the contours for the permissible uses of the biometrics collected in the underlying biometric-facilitated transaction to ensure that the data collected is used only for the fulfillment of the transaction in question. Once biometric data is collected by a private entity, there is no further prospective BIPA right that the individual can exercise --- and thus that the 31

32 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 32 of 51 individual could be advised about at the outset --- other than to expand the scope of the underlying transaction pursuant to Section 15(d). See Strubel, 2016 WL , at *8 (finding that disclosures that did not hinder the exercise of prospective rights that the consumer could exercise weighed against a finding of standing). Even without fully compliant notice and consent, no concrete BIPA interest can be harmed so long as the private entity only uses the biometrics collected as both parties intended. See McCollough, 2016 WL , at *3. In arguing that bare violations of the notice and consent provisions alone can support standing, the plaintiffs are essentially attempting to bootstrap two sets of bare procedural violations --- the alleged procedurally deficient notice and consent that failed to warn the plaintiffs about the later procedural violations of the BIPA with respect to storage and dissemination --- without establishing a material risk to a concrete interest protected by the BIPA. But in the absence of a connection between a procedural violation and a concrete interest, a bare violation of the former does not manifest injury in fact. Strubel, 2016 WL , at *4. The only concrete interest protected by the BIPA is biometric data protection. Because the plaintiffs have failed to establish a material risk to that interest, the plaintiffs claims of 32

33 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 33 of 51 violations of the notice and consent provisions of the BIPA must be dismissed for want of standing. Moreover, the difference between the actual notice and consent in this case, and that purportedly required by the BIPA, does not rise to more than a procedural violation, which is plainly insufficient for standing under Spokeo and Strubel. There is no plausible allegation that, based on the notice the plaintiffs received, the plaintiffs did not understand that their faces would be scanned, and that those face scans would be used to create personalized basketball avatars. The plaintiffs allege that they received advance notice that their faces would be scanned, that they consented to have their faces scanned when they agreed to the MyPlayer terms and conditions, and that Take- Two used the face scans to create personalized basketball avatars. Ricardo Vigil allegedly bought NBA 2K15 so that the plaintiffs could use the MyPlayer feature for its only alleged purpose, the creation of personalized basketball avatars. The plaintiffs further allege that they appreciated that the digitized renditions of their faces would appear onscreen in multiplayer mode over the Internet. The allegations establish that the plaintiffs understood the purpose of using the MyPlayer feature, and there is no allegation that Take-Two has strayed from that purpose. 33

34 Case 1:15-cv JGK Document 74 Filed 01/30/17 Page 34 of 51 Although the MyPlayer terms and conditions explicitly referenced face scans, SAC 28, the plaintiffs claim that they did not understand that their face scans were unique biometric identifiers as defined by the BIPA. To the extent that informing a subject in a notice about a face scan (a type of biometric identifier), as opposed to using the specific words biometric identifier (a statutory term of art), is in fact a violation of the BIPA, the alleged violation is merely a procedural violation, and poses no real risk of harm to a BIPA interest. The allegations show that the plaintiffs, at the very least, understood that Take-Two had to collect data based upon their faces in order to create the personalized basketball avatars, and that a derivative of the data would be stored in the resulting digital faces of those avatars so long as those avatars existed. See McCollough, 2016 WL , at *1 n.1, *3 (finding that it would be inconceivable that a plaintiff would not understand that a locker that used a fingerprint to lockand-unlock the locker would not collect and store fingerprint data). The gravamen of the plaintiffs right-to-information theory is thus necessarily that, even though the plaintiffs understood the purpose of the face scans, the plaintiffs did not adequately understand that Take-Two had a duty under the BIPA to destroy their biometric data within a prescribed time period. Although 34